New Wiper Malware HermeticWiper targets Ukrainian systems

Cybersecurity experts discovered a new data wiper malware that was used in attacks against hundreds of machines in Ukraine.

The threat of hybrid warfare is reality, Russia-linked APT group have supported the operations of the Russian army while preparing for the invasion.

Researchers from cybersecurity firms ESET and Broadcom’s Symantec discovered a new data wiper malware that was employed in a recent wave of attacks that hit hundreds of machines in Ukraine.

Breaking. #ESETResearch discovered a new data wiper malware used in Ukraine today. ESET telemetry shows that it was installed on hundreds of machines in the country. This follows the DDoS attacks against several Ukrainian websites earlier today 1/n

— ESET research (@ESETresearch) February 23, 2022

New #wiper malware being used in attacks on #Ukraine
1bc44eef75779e3ca1eefb8ff5a64807dbc942b1e4a2672d77b9f6928d292591

— Threat Intelligence (@threatintel) February 23, 2022

A tweet from ESET revealed that the company’s telemetry shows the presence of the wiper, tracked as “HermeticWiper” (aka KillDisk.NCV), on hundreds of machines in the country. According to the security firm, the infections followed the DDoS attacks against several Ukrainian websites, including Ministry of Foreign Affairs, Cabinet of Ministers, and Rada.

The first sample of the wiper was observed by ESET yesterday around 14h52 UTC (16h52 local time), but more interesting is the PE compilation timestamp of one of the samples which is 2021-12-28, suggesting that the cyber attack might have been in preparation for almost two months.

The malicious binary was signed using a code signing certificate issued to Hermetica Digital Ltd.

The Wiper binary is signed using a code signing certificate issued to Hermetica Digital Ltd 3/n pic.twitter.com/sGCl3Lbqc1

— ESET research (@ESETresearch) February 23, 2022

The wiper abuses legitimate drivers from the EaseUS Partition Master software for corrupt data.

In at least one of the targeted organizations, the attackers have taken control of the Active Directory server and dropped via the default Group Policy Object (GPO).

At this time, there is no info to determine the impact of attacks employing the data wiper. Experts did not publicly attribute the attack to Russia, anyway, this is the second wiper that was deployed in a few weeks on Ukrainian computer systems after the WhisperGate.

Yesterday, a new wave of DDoS attacks hit Ukrainian government websites and banks.

“Today, websites of a number of government and banking institutions have undergone a massive DDoS attack again. Some of the attacked information systems are not available or work intermittently. This is due to switching traffic to another provider to minimize damage. Other websites effectively resist the attack and work normally.” reads the alert published by State Service of Special Communications and Information Protection of Ukraine.

“Currently, the State Service of Special Communications and Information Protection of Ukraine and other subjects of the national cybersecurity system are working on countering the attacks, collecting and analyzing information.”

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Ukraine)

The post New Wiper Malware HermeticWiper targets Ukrainian systems appeared first on Security Affairs.

Recent Posts
Contact Us

We're not around right now. But you can send us an email and we'll get back to you, asap.

Not readable? Change text. captcha txt